PWS.pdf

PERFORMANCE WORK STATEMENT

Fleet Numerical Meteorology and Oceanography Center

Navy Ocean Sound Speed Prediction (NOSSP) Ocean Modeling System and Forecasting Critical Documentation Support

1.0 INTRODUCTION

The Fleet Numerical Meteorology and Oceanography Center (FLENUMMETOCCEN), under the direction of the Commander, Naval Meteorology and Oceanography Command (METOC), has the mission to collect, interpret, and apply global atmospheric and oceanographic data and information in support of strategic and tactical warfare and peace-keeping initiatives. Located in Monterey, CA, and at Stennis Space Center, MS, FLENUMMETOCCEN runs regularly scheduled numerical predictions of the global atmosphere and ocean. FLENUMMETOCCEN consists of supercomputer systems that run the numerical atmospheric/oceanographic models and other systems, including clusters, which provide data communications, pre- and post-processing, derived applications, and web services. METOC products are then distributed either directly to customers, including active warfighters, or to regional centers and made available to Department of Defense (DOD) activities worldwide.

FLENUMMETOCCEN operates a sophisticated suite of numerical environmental models and customer product applications that exploit all levels of High Performance Computing (HPC).

The systems that comprise FLENUMMETOCCEN's computing suite are called the Primary Oceanographic Prediction System- Meteorology (POPS-Met). FLENUMMETOCCEN processes the world's most complete database of oceanographic and atmospheric observations assimilated several times daily into global and regional METOC models.

2.0 BACKGROUND

The Fleet Numerical Meteorology and Oceanography Center (FLENUMMETOCCEN), under the direction of the Commander, Naval Meteorology and Oceanography Command, runs regularly scheduled numerical predictions of the global atmosphere and ocean. Located in Monterey, CA, and at Stennis Space Center, MS, FLENUMMETOCCEN products are distributed directly to Department of Defense (DOD) activities worldwide.

The Navy Ocean Sound Speed Prediction (NOSSP) Ocean modeling system, Rapid Ocean Atmosphere Modeling Environment-Relocatable (ROAMER) model management system and Navy Ocean Forecasting Tools (NOFT) provide on-demand, multiresolution Numerical Ocean Prediction (NOP) capability.

2.1 Requiring Organization:

The organization requiring the services outlined in the Performance Work Statement (PWS) is:

FLENUMMETOCCEN

7 Grace Hopper Avenue, Stop 1

Monterey, CA 93943-5501

3.0 SCOPE:

The contractor shall support documentation of NOSSP and Ocean Forecasting application software and processes and ensure this documentation is accurate and complete.

3.1 NOSSP

3.1.1 Provide System and Application documentation for NOSSP software, systems, and supporting processes. Create new and update existing documents to reflect modification performed under contract to include:

• In-line documentation in software source code.

• System reference guide.

• Detailed annotated graphical depictions of process flow (flow-charts/wire-diagrams).

• Specifications for Input/Output data, Control files and Output product(s).

• Document any differences between NIPRNET and SIPRNET software and infrastructure.

• Standard Operating Procedures

3.2 Ocean Forecasting

3.2.1 Provide System and Application documentation for Ocean Forecasting software, systems, and supporting processes. Create new and update existing documents to reflect modification performed under contract to include:

• In-line documentation in software source code.

• System reference guide.

• Detailed annotated graphical depictions of process flow (flow-charts/wire-diagrams).

• Specifications for Input/Output data, Control files and Output product(s).

• Document any differences between NIPRNET and SIPRNET software and

• Standard Operating Procedures

4.0 DIRECTIVES

The contractor shall comply with the following directives, and any updated/future versions as they are released:

• 32 CFR Part 117, National Industrial Security Program operating Manual, 24 February 2021

• DoD Information Assurance Certification and Accreditation Process (DIACAP)

Handbook, 15 July 2008

• ISSM Handbook Version 1.0 – 15 July 2008

• U.S. Navy Risk Management Framework Process Guide, Version 3.3, 28 October 2021

• DoD Instruction 8500.01, Cybersecurity, 14 March 2014 (incorporating Change 1, 7 October 2019)

• DoD Instruction 8510.01, Risk Management Framework (RMF) for DoD

Information Technology, 12 March 2014 (incorporating Change 2, 28 July 2017)

• DoD Manual 5200.02, Procedures for the DoD Personnel Security Program (PSP), 3 April 2017 (incorporating change 1, 29 October 2020)

• DODI 5200.46, DoD Investigative and Adjudicative Guidelines for Issuing the

Common Access Card (CAC), 9 September 2014 (incorporating change 1, 4 May 2018)

• DoDI 5200.48, Controled Unclassified Information (CUI), 6 March 2020

• DoDM 5200.1 Volume 1, DoD Information Security Program: Overview, Claasification snd Declassification, (incorporating Change 2, 28 July 2020)

• DoDM 5200.01 Volume 2, DoD Information Security Program: Marking of

Information, 24 February 2012 (incorporating change 4, 28 July 2020)

• DoDM 5200.01 Volume 3, DoD Information Security Program: Protection of

Classified Information, February 2012 (Incorporating Change 3 July 28, 2020)

• DoD 5220.22, Volume 2, National Industrial Security Program: Security

Procedures for Government Activities Operating Manual, 1 August 2018

• DODD 5240.06, Counter Intelligence Awareness and Reporting (CCSR), 17 May

2011 (incorporating change 2, 21 July 2017)

• OPNAVINST 5530.14E, Navy Physical Security and Law Enforcement Program, 28 January 2009 (incorporating change 2, 23 September 2014)

• FLENUMMETOCCENINST 5510.1K, Command Information and Personnel

Security Manual, 6 July 2018

• FLENUMMETOCCENINST 5239.3C, Access Policy for Command Information

Systems, 24 May 2018

• FLENUMMETOCCENINST 5239.4A, Command Cybersecurity Workforce

Implementation Plan, 12 October 2017

• FLENUMMETOCCEN A2 User’s Guide v-3.2, 23 March 2016

5.0 REQUIREMENTS/TASKS

5.1 REQUIREMENTS: Contractor shall maintain existing and new documents in the FLENUMMETOCCEN NOSSP/Ocean Prediction (OcnP) documentation library.

Documentation requirements include the following for both NIPRNET and SIPRNET, where applicable:

5.1.1 TASKS

Contractor shall create new and maintain existing documentation supporting the following:

5.1.1.1) Maintenance of NOSSP System and OcnP baseline documentation and all modifications to the baseline.

5.1.1.2) OcnP and NOSSP Business Rules, Standard Operating Procedures

(SOPs), Policy, and Guidance for:

• Account request process at the Naval Oceanographic Office

(NAVOCEANO) and FLENUMMETOCCEN, including example forms.

• Model operations and data management, including file transfers, deliveries, and storage

• Model setup, configuration, implementation, execution including rerunning, and troubleshooting for all model types

• OcnP/NOSSP configuration management

• Model Operations software storage and documentation back-up policy

• NAVOCEANO NIPRNET to SIPRNET Cross-Domain Solution

5.1.1.3) NOSSP System – infrastructure to support automated OcnP nested, data assimilating and non-data assimilating, two- and three-dimensional, tidal and full-physics ocean and wave models and product generation, including documentation of computational resource availability and usage.

5.1.1.4) Rapid Ocean Atmosphere Model Environment, Relocatable (ROAMER) system – FLENUMMETOCCEN-Stennis’s relational database with a web-portal interface to the database and modules, including the Model Monitoring System (MMS) and Model Alert System (MAS), that monitor, use, and refresh the information stored in the database to carry out specific operational functions. Components include:

• ROAMER system and modules

• ROAMER database design and structure

• ROAMER portal - web based interface

5.1.1.5) Model Operations – check lists, system software, automated and manual model operations, production processes, system and error monitoring and logging.

5.1.1.6) Maintain procedures and troubleshooting documentation. Operations troubleshooting documentation contains graphics and system log examples to help OcnP personnel identify, diagnose, and solve model operations problems.

5.1.1.7) System and software tools used by model operations personnel to automatically and manually check the “health and status” of complete model operational system.

5.1.1.8) Request for Service (RFS) modules, interfaces, and SOPs for interface use and RFS management.

5.1.1.9) Automated Product Generation for:

• Standard and optional files and Network Common Data Form

(NetCDF) files

• Standard graphics, Keyhole Markup Language (KML), encrypted

American Standard Code for Information Interchange (ASCII) files using wavelet or other compression, and NetCDF products for access via Unified Production Support (UPS) webpages

• Ocean Prediction Products Page, a graphical user interface for accessing OcnP products

• Submarine Support Page, a webpage that hosts automatically generated wavelet files

• Interactive Model Display, an interactive, web-based capability that allows end users to animate model predictions through the forecast period and to view time-series of model predictions at pre-defined locations.

5.1.1.10) Product Delivery – document system software, formats, and SOPs used to move ocean forecasting products to the appropriate internal and external delivery locations:

• Standard and special UPS webpages

• Standard graphics, KML, wavelet, and NetCDF products

• Ocean Prediction Products Page

• Data Archive, both on DoD Supercomputing Resource Center

(DSRC) and internal NAVOCEANO Storage Area Network

(SAN)

• External (to NAVOCEANO network) users

• Custom data services

5.1.1.11) NIPRNET to SIPRNET Cross Domain Solution - System infrastructure

5.1.1.12) Network dependencies and alternate solutions for incoming and outgoing file deliveries, such as Defense, Research, and Engineering Network (DREN), Committee for Operational Processing Centers (COPC), etc.

5.1.1.13) Maintain existing and create new process wiring diagrams in a government-identified format.

5.1.1.14) Document NOSSP Ocean Modeling System Business Rules, SOPs, Policy, and Guidance for:

• Modeling, model operations, and data management, including changes resulting from consolidation of processes and procedures between FLENUMMETOCCEN-Monterey and FLENUMMETOCCEN-Stennis

5.1.1.15) Contractor shall provide all documentation both in digital and hardcopy format.

• Documentation shall follow OcnP standard document formats specified below.

• All documents shall be uploaded and made available in a government-identified location.

• Hardcopies of documentation shall be kept up to date for periods without network availability, such as during hurricanes/emergencies.

5.1.1.16) Contractor shall provide Model Operations Data Flow Diagrams (Wire-Diagrams) updates in Adobe PDF, and/or other file formats as designated by government technical points of contact.

• Model Operations Data Flow Diagrams are a graphic representation of a logic sequence in a formalized structure of specific OcnP model operation processes, data, and file movement using standard symbology and interconnecting lines.

• The purpose of a flow chart is to provide a standard reference and common terminology as the foundation for understanding and/or isolating errors/issues with a model operation process.

5.1.1.17) Contractor shall provide Standard Operating Procedures (SOPs) in MS PowerPoint, MS Word, Adobe PDF, and/or other format as designated by government technical points of contact and shall include:

• Detailed documentation that provides step-wise procedures on how to run the software, ingest data, analyze data, generate products, and deliver products to final destination and to archive.

• Numerous annotated graphical depictions (i.e., screen copies – examples).

5.1.1.18) Contractor shall provide Software System Documentation - Reference Guide in Microsoft Word. Guide provides a detailed description of the “overall software system”, to include:

• Software modules with functions

• Input/output data

• Setup and parameterization files

• Internal data structures

• Database system

• File distribution system

5.1.1.19) Contractor shall provide trouble-shooting guides – examples are:

• Business Rules, Procedures, Guidance, and Policies

• Infrastructure documentation, ocean model documentation

• Model Operations SOPs

• Model Operation System Checklists - troubleshooting guides to assist Model Operations Watchstanders in addressing operational issues

• Forecasting Checklist - troubleshooting guides to assist Model Operations Watchstanders in addressing operational issues

• Model Operations Data Flow Diagrams (Wire-Diagrams)

• DSRC Model/Domain Schedules 5.1.1.20) Document any differences between NIPRNET and SIPRNET software and infrastructure.

Performance Standard:

Documentation will follow generally accepted formatting and grammatical standards.

Assessment Method:

Subject Matter Experts will conduct reviews of documentation prior to acceptance.

5.2 REQUIREMENTS: Contractor shall maintain existing and new documents in the FLENUMMETOCCEN Ocean Forecasting documentation library. Documentation requirements include the following for both NIPRNET and SIPRNET, where applicable. The Contractor shall provide comprehensive documentation services to include:

5.2.1 TASK

Contractor shall create new and maintain existing documentation supporting the following:

5.2.1.1) Maintain Ocean Forecasting Documentation Library for system baseline and all modifications to baseline.

5.2.1.2) Business Rules, Policy and Guidance:

• Ocean Forecaster Assignment and Tracking Process

• Standard metadata and naming conventions

5.2.1.3) Software Suite for Ocean Forecasting – SOPs necessary for use by Ocean Forecasters for product generation:

• ArcGIS Reach-back Cell Oceanography Analysis System (ARCOAS), Esri ArcGIS Desktop framework data and model analysis, viewing, processing, and product generation tool.

• Coastal Forecasting Tools and their components.

• Drift prediction software.

• Observation Quick Look Display Page.

• Ocean, wave, and tidal model setup procedures.

5.2.1.4) Product Generation to include:

• Tactical Oceanographic Feature Assessment (TOFA) and Standard Area Assessment Layer Packs – including Geographic Information System (GIS) Layer Packages, KML, OVLY-2, Text, and MS PowerPoint products.

• Ocean Feature Analysis (OFA) – fronts and eddies, in text, graphical, shapefile, and Over-the-Horizon Gold (OTH-GOLD) format

• Wave Model Products

• Coastal Prediction Products

• Water Sampling Plan

• Object Drift Analysis, Trajectory, and Probability products

5.2.1.5) All documentation shall be provided both in digital and hardcopy format.

• Documentation shall follow Ocean Forecast standard document formats specified below.

• All documents shall be uploaded and made available in a government-identified location.

• Hardcopies of documentation shall be kept up to date for periods without network availability, such as during hurricanes/emergencies.

5.2.1.6) SOPs shall be delivered in Microsoft PowerPoint, Microsoft Word, Adobe

PDF, and/or other government-identified format.

• Detailed documentation that provides step-wise procedures on how to run the software, ingest data, analyze data, generate products, and deliver products to final destination and to archive.

• Contains numerous annotated graphical depictions (i.e., screen copies

– examples).

5.2.1.7) Software System Documentation - Reference Guide shall be delivered in Microsoft Word. Guide provides a detailed description of the “overall software system”, to include:

• Software modules with functions

• Input/output data

• Setup and parameterization files

• Internal data structures

5.2.1.8) Document any differences between NIPRNET and SIPRNET software and

All design changes, software changes, and documentation shall be backed-up according to OcnP policies and guidelines.

Performance Standard:

Documentation will follow generally accepted formatting and grammatical standards.

Assessment Method:

Subject Matter Experts will conduct reviews of documentation prior to acceptance.

5.3 Bi-weekly Status Reports The contractor shall provide a bi-weekly status report (BSR) to the TPOC. The BSR shall provide a high level bi-weekly summary of activities and issues uncovered as well as anticipated issues. It shall be accurate and, as a deliverable, stand up to the scrutiny of review. The BSR shall contain the following sections:

• Summary of Accomplishments and Significant Events

• Deliverables Assigned/Milestones/Status

• Deliverables Submitted

• Current or Anticipated Issues

• Government-Identified Topics and Issues

• Summary of Activity Planned for the Next Reporting Period

5.4 Technical Clarification Notice

Technical Clarification Notices (TCN) will be used to clarify areas of support required by this order. TCNs may be used to: prioritize support; further define level, location or schedule of support to be provided; and/or output requirements (e.g., deliverables). TCNs may be generated by either the contractor or the Government, but must be fully coordinated and approved by the TPOC prior to execution. TCNs shall not be used to change the intent, scope, or value of this order.

6.0 DELIVERABLES AND MILESTONES

Deliverables shall be provided by the contractor to the FLENUMMETOCCEN TPOC.

Electronic documents shall be in Microsoft Office, Microsoft Project, or Adobe format unless otherwise agreed to by the Government. Electronic documents will be in an editable form without password protection. The government will review and approve or disapprove deliverables within 7 working days of receipt. The Contractor shall consider the deliverable accepted if a government response has not been provided within the 7 working day review time.

Disapproved deliverables shall be reworked and resubmitted within 5 working days of contractor notification unless the TPOC and contractor mutually agree upon other terms.

The following are contractor responsibilities:

Deliverable Section Frequency Format/Qty Due Date Documentation and final Task Statement Report

5.1

As Required Disk(s), system drive location(s) and MS Office Electronic Submission as appropriate and DI2E/Jira and/or WIKI submission when appropriate

Within 7 days of completion

Documentation and final Task Statement Report

5.2 As Required Disk(s), system

drive location(s) and MS Office Electronic Submission as appropriate and DI2E/Jira and/or WIKI submission when appropriate

Within 7 days of completion

Deliverable Section Frequency Format/Qty Due Date Hard and digital copies of documentation and a final Task Statement Report

5.1 - 5.2 As Required Hard copy, MS Office Electronic Submission, and DI2E/Jira and/or WIKI submission when appropriate

No later than 5 days prior to end of period of performance

Combatting Trafficking In Person

Compliance with FAR 52.222-50

COR will review documentation or interview contractor personnel

Annually 100%

7.0 PERIOD OF PERFORMANCE

The period of performance shall be from 29 September 2022 to 28 September 2023.

8.0 PLACE OF PERFORMANCE

The primary place of performance for up to 1 contractor at any one time shall be on-site at the FLENUMMETOCCEN facility located at 1002 Balch Blvd, Stennis Space Center, MS 39522.

Additional contractors will have to work off site in contractor provided spaces.

9.0 TRAVEL REQUIREMENTS

Travel is not anticipated for this task.

10.0 SECURITY REQUIREMENTS

10.1 The contractor shall be responsible for adhering to all Department of the Navy (DoN) and command instructions, guidance, orders, directives, and supplements relative to performing work on NOSSP and Forecasting Documentation.

10.2 The primary place of performance shall be on-site at the FLENUMMETOCCEN, Stennis Space Center facility, which dictates all personnel performing on-site must possess and maintain US Citizenship and an active National Security clearance eligibility of SECRET or higher, based on a current Tier 3 investigation, or Tier 5 investigation. The scope of this work is considered to be a noncritical sensitive position. The incumbent must be compliant with DOD required training and certification for the IT Workforce.

10.3 As defined in DOD 8570.01-M, “Information Assurance Workforce Improvement Program”, this position IS NOT part of the Cybersecurity Workforce. It DOES NOT involve management of CS controls and DOES NOT require privileged access.

10.4 The contract holder and actual service provider must have facility clearances at the same level as the individuals required in the Performance Work Statement (PWS).

10.5 SUPTXT204-9400(3-19) Contractor Unclassified Access to Federally Controlled Facilities, Sensitive Information, Information Technology (IT) Systems or Protected Health Information

Homeland Security Presidential Directive (HSPD)-12, requires government agencies to develop and implement Federal security standards for Federal employees and contractors.

The Deputy Secretary of Defense Directive-Type Memorandum (DTM) 08-006 – “DOD Implementation of Homeland Security Presidential Directive – 12 (HSPD-12)” dated November 26, 2008 (or its subsequent DOD instruction) directs implementation of HSPD-

12. This clause is in accordance with HSPD-12 and its implementing directives.

a. APPLICABILITY This clause applies to contractor employees requiring physical access to any area of a federally controlled base, facility or activity and/or requiring access to a DoN or DOD computer / network / system to perform certain unclassified sensitive duties. This clause also applies to contractor employees who access Privacy Act and Protected Health Information, provide support associated with fiduciary duties, or perform duties that have been identified by DON as National Security Position, as advised by the command security manager. It is the responsibility of the responsible security officer of the command/facility where the work is performed to ensure compliance.

Each contractor employee providing services at a Navy Command under this contract is required to obtain a Department of Defense Common Access Card (DOD CAC).

Additionally, depending on the level of computer/network access, the contract employee will require a successful investigation as detailed below.

b. ACCESS TO FEDERAL FACILITIES Per HSPD-12 and implementing guidance, all contractor employees working at a federally controlled base, facility or activity under this clause will require a DOD CAC. When access to a base, facility or activity is required contractor employees shall in-process with the Navy Command’s Security Manager upon arrival to the Navy Command and shall out-process prior to their departure at the completion of the individual’s performance under the contract.

c. ACCESS TO DOD IT SYSTEMS In accordance with SECNAV M-5510.30, contractor employees who require access to DoN or DOD networks are categorized as IT-I, IT-II, or IT-III. The IT-II level, defined in detail in SECNAV M-5510.30, includes positions which require access to information protected under the Privacy Act, to include Protected Health Information (PHI). All contractor employees under this contract who require access to Privacy Act protected information are therefore categorized no lower than IT-II. IT Levels are determined by the requiring activity’s Command Information Assurance Manager. Contractor employees requiring privileged or IT-I level access, (when specified by the terms of the contract) require a Single Scope Background Investigation (SSBI) which is a higher level investigation than the National Agency Check with Law and Credit (NACLC) described below. Due to the privileged system access, a SSBI suitable for High Risk public trusts positions is required. Individuals who have access to system control, monitoring, or administration functions (e.g. system administrator, database administrator) require training and certification to Information Assurance Technical Level 1, and must be trained and certified on the Operating System or Computing Environment they are required to maintain.

Access to sensitive IT systems is contingent upon a favorably adjudicated background investigation. When access to IT systems is required for performance of the contractor employee’s duties, such employees shall in-process with the Navy Command’s Security Manager and Information Assurance Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The decision to authorize access to a government IT system/network is inherently governmental. The contractor supervisor is not authorized to sign the SAAR-N; therefore, the government employee with knowledge of the system/network access required or the TPOC shall sign the SAAR-N as the “supervisor”.

The SAAR-N shall be forwarded to the Navy Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

When required to maintain access to required IT systems or networks, the contractor shall ensure that all employees requiring access complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

d. INTERIM ACCESS The Navy Command's Security Manager may authorize issuance of a DOD CAC and interim access to a DoN or DOD unclassified computer/network upon a favorable review of the investigative questionnaire and advance favorable fingerprint results. When the results of the investigation are received and a favorable determination is not made, the contractor employee working on the contract under interim access will be denied access to the computer network and this denial will not relieve the contractor of his/her responsibility to perform.

e. DENIAL OR TERMINATION OF ACCESS The potential consequences of any requirement under this clause including denial or termination of physical or system access in no way relieves the contractor from the requirement to execute performance under the contract within the timeframes specified in the contract. Contractors shall plan ahead in processing their employees and subcontractor employees. The contractor shall insert this clause in all subcontracts when the subcontractor is permitted to have unclassified access to a federally controlled facility, federally-controlled information system/network and/or to government information, meaning information not authorized for public release.

f. CONTRACTOR’S SECURITY REPRESENTATIVE The contractor shall designate an employee to serve as the Contractor’s Security Representative. Within three work days after contract award, the contractor shall provide to the requiring activity’s Security Manager and the Contracting Officer, in writing, the name, title, address and phone number for the Contractor’s Security Representative. The Contractor’s Security Representative shall be the primary point of contact on any security matter. The Contractor’s Security Representative shall not be replaced or removed without prior notice to the Contracting Officer and Command Security Manager.

g. BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY

APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO NATIONAL

SECURITY POSITIONS OR PERFORMING SENSITIVE DUTIES

Navy security policy requires that all positions be given a sensitivity value based on level of risk factors to ensure appropriate protective measures are applied. Navy recognizes contractor employees under this contract as Non-Critical Sensitive [ADP/IT-II] when the contract scope of work require physical access to a federally controlled base, facility or activity and/or requiring access to a DOD computer/network, to perform unclassified sensitive duties. This designation is also applied to contractor employees who access Privacy Act and Protected Health Information (PHI), provide support associated with fiduciary duties, or perform duties that have been identified by DON as National Security Positions. At a minimum, each contractor employee must be a US citizen and have a favorably completed NACLC to obtain a favorable determination for assignment to a non-critical sensitive or IT-II position. The NACLC consists of a standard NAC and a FBI fingerprint check plus law enforcement checks and credit check. Each contractor employee filling a non-critical sensitive or IT-II position is required to complete:

• SF-86 Questionnaire for National Security Positions (or equivalent OPM investigative product)

• Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

• Original Signed Release Statements

Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date. Background investigations shall be reinitiated as required to ensure investigations remain current (not older than 10 years) throughout the contract performance period. The Contractor’s Security Representative shall contact the Command Security Manager for guidance when reinvestigations are required.

Regardless of their duties or IT access requirements ALL contractor employees shall in-process with the Navy Command’s Security Manager upon arrival to the Navy command and shall out-process prior to their departure at the completion of the individual’s performance under the contract. Employees requiring IT access shall also check-in and check-out with the Navy Command’s Information Assurance Manager. Completion and approval of a System Authorization Access Request Navy (SAAR-N) form is required for all individuals accessing Navy Information Technology resources. The SAAR-N shall be forwarded to the Navy Command’s Security Manager at least 30 days prior to the individual’s start date. Failure to provide the required documentation at least 30 days prior to the individual’s start date shall result in delaying the individual’s start date.

The contractor shall ensure that each contract employee requiring access to IT systems or networks complete annual Information Assurance (IA) training, and maintain a current requisite background investigation. Contractor employees shall accurately complete the required investigative forms prior to submission to the Navy Command Security Manager.

The Navy Command’s Security Manager will review the submitted documentation for completeness prior to submitting it to the Office of Personnel Management (OPM).

Suitability/security issues identified by the Navy may render the contractor employee ineligible for the assignment. An unfavorable determination made by the Navy is final (subject to SF-86 appeal procedures) and such a determination does not relieve the contractor from meeting any contractual obligation under the contract. The Navy Command’s Security Manager will forward the required forms to OPM for processing.

Once the investigation is complete, the results will be forwarded by OPM to the DON Central Adjudication Facility (CAF) for a determination.

If the contractor employee already possesses a current favorably adjudicated investigation, the contractor shall submit a Visit Authorization Request (VAR) via the Joint Personnel Adjudication System (JPAS) or a hard copy VAR directly from the contractor’s Security Representative. Although the contractor will take JPAS “Owning” role over the contractor employee, the Navy Command will take JPAS "Servicing" role over the contractor employee during the hiring process and for the duration of assignment under that contract. The contractor shall include the IT Position Category per SECNAV M-

5510.30 for each employee designated on a VAR. The VAR requires annual renewal for the duration of the employee’s performance under the contract.

h. BACKGROUND INVESTIGATION REQUIREMENTS AND SECURITY

APPROVAL PROCESS FOR CONTRACTORS ASSIGNED TO OR PERFORMING

NON-SENSITIVE DUTIES

Contractor employee whose work is unclassified and non-sensitive (e.g., performing certain duties such as lawn maintenance, vendor services, etc.) and who require physical access to publicly accessible areas to perform those duties shall meet the following minimum requirements:

• Must be either a US citizen or a US permanent resident with a minimum of 3 years legal residency in the United States (as required by The Deputy Secretary of Defense DTM 08-006 or its subsequent DOD instruction) and

• Must have a favorably completed National Agency Check with Written Inquiries (NACI) including a FBI fingerprint check prior to installation access.

To be considered for a favorable trustworthiness determination, the Contractor’s Security Representative must submit for all employees each of the following:

• SF-85 Questionnaire for Non-Sensitive Positions

• Two FD-258 Applicant Fingerprint Cards (or an electronic fingerprint submission)

• Original Signed Release Statements

The contractor shall ensure each individual employee has a current favorably completed National Agency Check with Written Inquiries (NACI) or ensure successful FBI fingerprint results have been gained and investigation has been processed with OPM Failure to provide the required documentation at least 30 days prior to the individual’s start date may result in delaying the individual’s start date.

* Consult with your Command Security Manager and Information Assurance Manager for local policy when IT-III (non-sensitive) access is required for non-US citizens outside the United States.

(End of Clause)

11.0 GOVERNMENT PROVIDED RESOURCES

11.1 The Government will provide the contractor any government furnished resources required to support performance of the effort in this order. The Contractor shall establish and maintain an inventory control system covering all accountable Government-furnished resources supplied under the order.

11.2 The Government will provide the contractor access to systems and software required to complete the assigned tasks for up to 2 contractors at any one time. The Contractor shall identify and notify the Government of system documentation necessary for the proper performance of this task.

11.3 The contractor shall be furnished with documentation, task working papers, project descriptions, program briefing material and other pertinent information, and other documentation or material required to support performance of the effort in this order.

Information will be provided to the contractor within a reasonable time commensurate with schedules and target completion dates for assigned tasks and activities.

11.4 In performance of services under this order, the contractor may be required to perform operations on, have access to, or handle data and information that contains sensitive, proprietary, privacy information and data. The contractor shall be responsible for safeguarding the information and data while under the control of or available to the contractor and preventing it from being compromised, damaged, lost, or properly disseminated. Unless authorized by the Government, information and data shall not be released outside FLENUMETOCCEN.

11.5 The Contractor and any employee or consultant of the Contractor is prohibited from using US Government facilities, equipment, or information for any purpose except as specifically described herein and related to this order. Contractor personnel shall not divulge or release data or information created or obtained in performance of this order until made public by the Government, except to authorized Government personnel. The contractor shall not use, disclose, or reproduce proprietary data other than as required in the performance of this order.

11.6 The Government will provide contractor with access to the FLENUMMETOCCEN Software Standards Manual and other appropriate documentation.

11.7 The Government will provide required office space and equipment necessary to accomplish prescribed tasks.

11.8 The Government will provide office supplies necessary for completion of tasks.

11.9 Government will provide security access cards to allow contractor access to all spaces required to carry out assigned tasks.

12.0 SKILL OR RELEVANT EXPERIENCE REQUIREMENTS

12.1 Personnel designated will be committed to the project for its duration and cannot be substituted or replaced without the written agreement of the TPOC. The Contracting Officer (KO) is authorized to remove any contractor personnel assigned to this task who are not meeting the task’s requirements. In these cases, the TPOC shall provide the KO written justification supporting a request for removal.

12.2 Personnel must have the following minimum skills and experience:

• 3 years experience:

o Microsoft Word, PowerPoint, Visio, Excel, Open Office on UNIX, Adobe

Acrobat Professional

• 2 years experience:

o Information System Documentation, technical editing, and publication.

• Batchelors Degree or experience in computer science, software engineering, or a physical science:

o Coursework covering computer science or physical science.

12.3KEY PERSONNEL QUALIFICATION REQUIREMENTS

The contractor shall commit key personnel to this effort for a period of twelve months from the date performance commences. Relief may be provided on a case by case basis by the KO.

The contractor’s replacement employee/s for key personnel shall possess the skill or relevant experience requirements set forth in paragraph 7.0 of this document. Documentation shall be submitted to the KO and TPOC. The KO MUST approve any substitution BEFORE substitution is made.

Language used to supplement DFARS Clause 252.204-7012 entitled, “Safeguarding Covered Defense Information and Cyber Incident Reporting” from the memorandum Updated Implementation of “the DIB Memo” dated 06 Sep 2019:

1. System Security Plan and Plans of Action and Milestones (SSP/POAM) Reviews

a) Within thirty (30) days of contract award, the Contractor shall make its System Security Plan(s) (SSP(s)) for its covered contractor information system(s) available for review by the Government at the contractor’s facility. The SSP(s) shall implement the security requirements in Defense

Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, which is included in this contract. The Contractor shall fully cooperate in the Government’s review of the SSPs at the Contractor’s facility.

b) If the Government determines that the SSP(s) does not adequately implement the requirements of DFARS clause 252.204-7012 then the Government shall notify the Contractor of each identified deficiency. The Contractor shall correct any identified deficiencies within thirty (30) days of notification by the Government. The contracting officer may provide for a correction period longer than thirty (30) days and, in such a case, may require the Contractor to submit a plan of action and milestones (POAM) for the correction of the identified deficiencies. The Contractor shall immediately notify the contracting officer of any failure or anticipated failure to meet a milestone in such a POAM.

c) Upon the conclusion of the correction period, the Government may conduct a follow-on review of the SSP(s) at the Contractor’s facilities. The Government may continue to conduct follow-on reviews until the Government determines that the Contractor has corrected all identified deficiencies in the SSP(s).

d) The Government may, in its sole discretion, conduct subsequent reviews at the Contractor’s site to verify the information in the SSP(s). The Government will conduct such reviews at least every three (3) years (measured from the date of contract award) and may conduct such reviews at any time upon thirty (30) days’ notice to the Contractor.

2. Compliance to NIST 800-171

a) The Contractor shall fully implement the CUI Security Requirements (Requirements) and associated Relevant Security Controls (Controls) in NIST Special Publication 800-171 (Rev. 1) (NIST SP 800-171), or establish a SSP(s) and POA&Ms that varies from NIST 800-171 only in accordance with DFARS clause 252.204-7012(b)(2), for all covered contractor information systems affecting this contract.

b) Notwithstanding the allowance for such variation, the contractor shall identify in any SSP and POA&M their plans to implement the following, at a minimum:

(1) Implement Control 3.5.3 (Multi-factor authentication). This means that multi-factor authentication is required for all users, privileged and unprivileged accounts that log into a network. In other words, any system that is not standalone should be required to utilize acceptable multi-factor authentication. For legacy systems and systems that cannot support this requirement, such as CNC equipment, etc., a combination of physical and logical protections acceptable to the Government may be substituted;

(2) Implement Control 3.1.5 (least privilege) and associated Controls, and identify practices that the contractor implements to restrict the unnecessary sharing with, or flow of, covered defense information to its subcontractors, suppliers, or vendors based on need-to-know principles;

(3) Implement Control 3.1.12 (monitoring and control remote access sessions) - Require monitoring and controlling of remote access sessions and include mechanisms to audit the sessions and methods.

(4) Audit user privileges on at least an annual basis;

(5) Implement:

i. Control 3.13.11 (FIPS 140-2 validated cryptology or implementation of NSA or NIST approved algorithms (i.e. FIPS 140-2 Annex A: AES or Triple DES) or compensating controls as documented in a SSP and POAM); and,

ii. NIST Cryptographic Algorithm Validation Program (CAVP) (see https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program);

(6) Implement Control 3.13.16 (Protect the confidentiality of CUI at rest) or provide a POAM for implementation which shall be evaluated by the Navy for risk acceptance.

https://csrc.nist.gov/projects/cryptographic-algorithm-validation-program

(7) Implement Control 3.1.19 (encrypt CUI on mobile devices) or provide a plan of action for implementation which can be evaluated by the Government Program Manager for risk to the program.

3. Cyber Incident Response:

a) The Contractor shall, within fifteen (15) days of discovering the cyber incident (inclusive of the

72-hour reporting period), deliver all data used in performance of the contract that the Contractor determines is impacted by the incident and begin assessment of potential warfighter/program impact.

b) Incident data shall be delivered in accordance with the Department of Defense Cyber Crimes Center (DC3) Instructions for Submitting Media available at http://www.acq.osd.mil/dpap/dars/pgi/docs/Instructions_for_Submitting_Media.docx. In delivery of the incident data, the Contractor shall, to the extent practical, remove contractor-owned information from Government covered defense information.

c) If the Contractor subsequently identifies any such data not previously delivered to DC3, then the Contractor shall immediately notify the contracting officer in writing and shall deliver the incident data within ten (10) days of identification. In such a case, the Contractor may request a delivery date later than ten (10) days after identification. The contracting officer will approve or disapprove the request after coordination with DC3.

4. Naval Criminal Investigative Service (NCIS) Outreach

The Contractor shall engage with NCIS industry outreach efforts and consider recommendations for hardening of covered contractor information systems affecting DON programs and technologies.

5. NCIS/Industry Monitoring

a) In the event of a cyber incident or at any time the Government has indication of a vulnerability or potential vulnerability, the Contractor shall cooperate with the Naval Criminal Investigative Service (NCIS), which may include cooperation related to: threat indicators; pre-determined incident information derived from the Contractor's infrastructure systems; and the continuous provision of all Contractor, subcontractor or vendor logs that show network activity, including any additional logs the contractor, subcontractor or vendor agrees to initiate as a result of the cyber incident or notice of actual or potential vulnerability.

b) If the Government determines that the collection of all logs does not adequately protect its interests, the Contractor and NCIS will work together to implement additional measures, which may include allowing the installation of an appropriate network device that is owned and maintained by NCIS, on the Contractor's information systems or information technology assets.

The specific details (e.g., type of device, type of data gathered, monitoring period) regarding the installation of an NCIS network device shall be the subject of a separate agreement negotiated between NCIS and the Contractor. In the alternative, the Contractor may install network sensor capabilities or a network monitoring service, either of which must be reviewed for acceptability by NCIS. Use of this alternative approach shall also be the subject of a separate agreement negotiated between NCIS and the Contractor.

c) In all cases, the collection or provision of data and any activities associated with this statement of work shall be in accordance with federal, state, and non-US law.

13.0 CLAUSES:

Privacy Act During performance of this order, the contractor may have access to Privacy Act data. Should this occur, the contractor shall safeguard all privacy information, and ensure this data is accessed and maintained IAW applicable laws and regulations.

Non-Disclosure Agreement:

The Business Sensitive Information Non-disclosure Agreement is required for this order.

Data Rights:

The Government shall have unlimited rights under this agreement to all information and materials furnished by the contractor performing work under this PWS. This shall include documentation thereof, reports and listings and all other items pertaining to the work and services pursuant to this agreement. The Government has the right to inspect the work and will have access to, and the right to make copies of the above mentioned items. All digital files, data and other items generated in performance of this effort shall become the property of the Government.

14.0 QUALITY CONTROL

The Contractor is solely responsible for the quality of services provided. The Contractor is also liable for Contractor employee negligence, and any fraud, waste or abuse.

15.0 HOURS OF OPERATION

The Contractor shall provide services during normal working hours excluding Federal holidays.

Normal working hours are 0730-1700, Monday through Friday, unless requirements dictate otherwise. An after- hours response may be required in some cases and will be at the COR’s discretion and arrangements made with the contractor ahead of time. Exceptions can be permitted by the COR upon request and at the COR’s discretion.

16.0 CONTRACTOR IDENTIFICATION

IAW DFAR 211.106, there shall be a clear distinction between government employees and service contractor employees. Service contractor employees shall identify themselves as contractor personnel by introducing themselves or being introduced as contractor personnel.

They must also display distinguishing badges or other visible items of identification for meetings with government personnel. In addition, contractor personnel shall appropriately identify themselves as contractor employees in telephone conversations and in formal and informal written correspondence.

17.0 POINTS OF CONTACT

FLENUMMETOCCEN COR, Quality Assurance Monitor and WAWF Acceptor:

Mr. Todd Rayburn

FLENUMMETOCCEN

1002 Balch Blvd, Stennis Space Center, MS 39522 228-688-4165 jeffery.t.rayburn.civ@us.navy.mil

FLENUMMETOCCEN Contract Administration:

Christopher Swope, Contract Liaison

FLENUMMETOCCEN

7 Grace Hopper Avenue, Stop 1 Monterey, CA 93943

(831) 657-1469 christopher.d.swope4.civ@us.navy.mil